Important Security Notice: PHP Update

22 October 2026 · Last updated: 23 October 2026

Two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been identified in PHP. Publicly known as PHP2Shell, these vulnerabilities can lead to remote code execution (RCE) on the server through a specially crafted web request, without requiring authentication.

The PHP Project has stated that all PHP installations serving web requests are at risk: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Systems using Apache mod_php are at the highest risk. Some security firms have reported observing exploitation attempts, including before the vulnerabilities were publicly disclosed. Do not delay the update.

Fixed PHP versions

The vulnerabilities have been fixed in the following versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Linux distributions may apply a security patch without changing the version number; therefore, check not only the version number but also the package changelog (shown below).

First, find out which PHP version you are using. Run the php -v command on the command line. The PHP that runs your website may be a different version from the one on the command line; to be sure, also check from your server management panel or from a phpinfo() page.

For Linux servers (Debian and Ubuntu)

  1. Refresh the package list:
sudo apt update
  1. Install the updates:
sudo apt upgrade

If you only want to update the PHP packages (replace the version number with your own version):

sudo apt install --only-upgrade php8.3-fpm php8.3-cli php8.3-common
  1. Restart the server. The updated PHP takes effect after the server is restarted. During the restart, the services on the server are briefly interrupted; therefore, do it at a suitable time.
sudo reboot
  1. Verify that the patch has been applied:
php -v
zcat /usr/share/doc/php8.3-common/changelog.Debian.gz | grep -E "CVE-2026-10961[89]"

The second command searches the package changelog for the two CVE numbers; if the patch has been applied, the line appears. If your PHP version is not 8.3, replace 8.3 in the command with your own version.

For Linux servers (RHEL, AlmaLinux, Rocky Linux)

sudo dnf upgrade --refresh 'php*'
sudo reboot

If you use the Remi repository (rpms.remirepo.net), according to the PHP Project’s announcement the update will not be published in this repository immediately; switch to the distribution’s own packages or build PHP from source code.

For Windows servers and computers

  1. Check your version: Run the php -v command in Command Prompt or PowerShell.
  2. Download the fixed version: From the php.net Windows download page, download the fixed version of the branch you use (8.2.35, 8.3.36, 8.4.27 or 8.5.12) as x64. If you use FastCGI with IIS, choose the Non Thread Safe (NTS) version; if you run it as an Apache module, choose the Thread Safe (TS) version. The builds require the Visual C++ 2015–2022 Redistributable.
  3. Back up the existing PHP folder (including php.ini and the extensions you use), extract the new version, and carry over your php.ini settings and extensions (DLL) in a way that is compatible with the new version.
  4. Restart the web server: For IIS, run the iisreset command in a command prompt opened as administrator (or recycle the relevant application pool). For Apache, restart the Apache service from Windows Services.
  5. Verify: The php -v command and a phpinfo() page should show that the version has been updated.

Ready-made packages such as XAMPP, WampServer or Laragon come with their own PHP. Install the latest version of the package that updates PHP, or replace the PHP folder inside the package using the steps above. If you use these packages on a server accessible from the internet, make the update a priority.

If you use PHP 8.1 or earlier

PHP 8.1 and earlier versions no longer receive official updates from the PHP Project. Some Linux distributions and long-term support (LTS) providers offer their own patched versions; confirm with your provider. If no patch is offered, move to a supported PHP version. The PHP Project has also published minimal patch branches for PHP 7.4, 8.0 and 8.1 intended for those who build from source code; this is not a substitute for a managed package update.

Temporary mitigations if you cannot update immediately

According to the PHP Project, these measures only reduce certain attack paths and do not make the system secure. The permanent solution is to update.

  • Set session.upload_progress.enabled=0 in php.ini, the FPM pool or the server configuration (ini_set() and .user.ini are not sufficient). On PHP 8.5, also set fatal_error_backtraces=0.
  • Set memory_limit=-1 in a way that applications cannot change (with php_admin_value in the FPM pool) and keep post_max_size low (8M if file uploads are not needed, 32M if they are; upload_max_filesize must remain below this).
  • After changing the settings, restart all PHP processes.

Check after updating

Updating does not show whether the vulnerability was exploited earlier. Security firms report that exploitation attempts date back to 17 October 2026. From that date onward, check the web server logs for unusual requests, the web directories for unexpected new files, and check for processes you do not recognize. If you have any suspicion, disconnect the system from the network and get expert support.

Update your Q-smart application too

After updating PHP, update your Q-smart application as well; the current Q-smart version works compatibly with the new PHP. Q-smart updates are free and we provide lifetime update support. Get help from our technical support team to update your application.

Technical support

If you do not want to perform this update yourself, if you need help on the servers where your Q-smart systems run, or if you are not sure whether your systems are affected, contact our company for technical support: our Contact page.

Sources: The PHP Project’s official announcement, “Security advisory: Critical remote code execution vulnerabilities, update now” (21 October 2026). Version downloads: php.net/downloads.php.

Scroll to Top